[installd] Create profile snaphots for boot image
Create the profile snapshot for the boot image by aggregating all primary
profiles. During aggregation data that does not belong to the boot image
is filtered out. The matching is done based on the dex files provided in
the classpath argument.
(cherry picked from commit e61189e0ad2104360a188d36210bd1ee43803a64)
Test: installd_dexopt_test
Bug: 30934496
Merged-In: Ib980ab3feb9f9838dff81a3861693cd08b1df9ab
Change-Id: Ib980ab3feb9f9838dff81a3861693cd08b1df9ab
diff --git a/cmds/installd/InstalldNativeService.cpp b/cmds/installd/InstalldNativeService.cpp
index 7ca3af1..ebf09c0 100644
--- a/cmds/installd/InstalldNativeService.cpp
+++ b/cmds/installd/InstalldNativeService.cpp
@@ -1854,12 +1854,13 @@
}
binder::Status InstalldNativeService::createProfileSnapshot(int32_t appId,
- const std::string& packageName, const std::string& profileName, bool* _aidl_return) {
+ const std::string& packageName, const std::string& profileName,
+ const std::string& classpath, bool* _aidl_return) {
ENFORCE_UID(AID_SYSTEM);
CHECK_ARGUMENT_PACKAGE_NAME(packageName);
std::lock_guard<std::recursive_mutex> lock(mLock);
- *_aidl_return = create_profile_snapshot(appId, packageName, profileName);
+ *_aidl_return = create_profile_snapshot(appId, packageName, profileName, classpath);
return ok();
}
diff --git a/cmds/installd/InstalldNativeService.h b/cmds/installd/InstalldNativeService.h
index bee6ac9..4650901 100644
--- a/cmds/installd/InstalldNativeService.h
+++ b/cmds/installd/InstalldNativeService.h
@@ -100,7 +100,7 @@
binder::Status destroyAppProfiles(const std::string& packageName);
binder::Status createProfileSnapshot(int32_t appId, const std::string& packageName,
- const std::string& profileName, bool* _aidl_return);
+ const std::string& profileName, const std::string& classpath, bool* _aidl_return);
binder::Status destroyProfileSnapshot(const std::string& packageName,
const std::string& profileName);
diff --git a/cmds/installd/binder/android/os/IInstalld.aidl b/cmds/installd/binder/android/os/IInstalld.aidl
index 097f2ae..626944e 100644
--- a/cmds/installd/binder/android/os/IInstalld.aidl
+++ b/cmds/installd/binder/android/os/IInstalld.aidl
@@ -65,7 +65,7 @@
void destroyAppProfiles(@utf8InCpp String packageName);
boolean createProfileSnapshot(int appId, @utf8InCpp String packageName,
- @utf8InCpp String profileName);
+ @utf8InCpp String profileName, @utf8InCpp String classpath);
void destroyProfileSnapshot(@utf8InCpp String packageName, @utf8InCpp String profileName);
void idmap(@utf8InCpp String targetApkPath, @utf8InCpp String overlayApkPath, int uid);
diff --git a/cmds/installd/dexopt.cpp b/cmds/installd/dexopt.cpp
index 8400808..a32165a 100644
--- a/cmds/installd/dexopt.cpp
+++ b/cmds/installd/dexopt.cpp
@@ -716,27 +716,34 @@
static constexpr int PROFMAN_BIN_RETURN_CODE_ERROR_LOCKING = 4;
static void run_profman_merge(const std::vector<unique_fd>& profiles_fd,
- const unique_fd& reference_profile_fd) {
- static const size_t MAX_INT_LEN = 32;
+ const unique_fd& reference_profile_fd, const std::vector<unique_fd>* apk_fds = nullptr) {
const char* profman_bin = is_debug_runtime() ? "/system/bin/profmand" : "/system/bin/profman";
std::vector<std::string> profile_args(profiles_fd.size());
- char profile_buf[strlen("--profile-file-fd=") + MAX_INT_LEN];
for (size_t k = 0; k < profiles_fd.size(); k++) {
- sprintf(profile_buf, "--profile-file-fd=%d", profiles_fd[k].get());
- profile_args[k].assign(profile_buf);
+ profile_args[k] = "--profile-file-fd=" + std::to_string(profiles_fd[k].get());
}
- char reference_profile_arg[strlen("--reference-profile-file-fd=") + MAX_INT_LEN];
- sprintf(reference_profile_arg, "--reference-profile-file-fd=%d", reference_profile_fd.get());
+ std::string reference_profile_arg = "--reference-profile-file-fd="
+ + std::to_string(reference_profile_fd.get());
+
+ std::vector<std::string> apk_args;
+ if (apk_fds != nullptr) {
+ for (size_t k = 0; k < apk_fds->size(); k++) {
+ apk_args.push_back("--apk-fd=" + std::to_string((*apk_fds)[k].get()));
+ }
+ }
// program name, reference profile fd, the final NULL and the profile fds
- const char* argv[3 + profiles_fd.size()];
+ const char* argv[3 + profile_args.size() + apk_args.size()];
int i = 0;
argv[i++] = profman_bin;
- argv[i++] = reference_profile_arg;
+ argv[i++] = reference_profile_arg.c_str();
for (size_t k = 0; k < profile_args.size(); k++) {
argv[i++] = profile_args[k].c_str();
}
+ for (size_t k = 0; k < apk_args.size(); k++) {
+ argv[i++] = apk_args[k].c_str();
+ }
// Do not add after dex2oat_flags, they should override others for debugging.
argv[i] = NULL;
@@ -2441,8 +2448,24 @@
}
}
-bool create_profile_snapshot(int32_t app_id, const std::string& package_name,
- const std::string& profile_name) {
+bool open_classpath_files(const std::string& classpath, std::vector<unique_fd>* apk_fds) {
+ std::vector<std::string> classpaths_elems = base::Split(classpath, ":");
+ for (const std::string& elem : classpaths_elems) {
+ unique_fd fd(TEMP_FAILURE_RETRY(open(elem.c_str(), O_RDONLY)));
+ if (fd < 0) {
+ PLOG(ERROR) << "Could not open classpath elem " << elem;
+ return false;
+ } else {
+ apk_fds->push_back(std::move(fd));
+ }
+ }
+ return true;
+}
+
+static bool create_app_profile_snapshot(int32_t app_id,
+ const std::string& package_name,
+ const std::string& profile_name,
+ const std::string& classpath) {
int app_shared_gid = multiuser_get_shared_gid(/*user_id*/ 0, app_id);
unique_fd snapshot_fd = open_spnashot_profile(AID_SYSTEM, package_name, profile_name);
@@ -2460,11 +2483,18 @@
profiles_fd.push_back(std::move(reference_profile_fd));
+ // Open the class paths elements. These will be used to filter out profile data that does
+ // not belong to the classpath during merge.
+ std::vector<unique_fd> apk_fds;
+ if (!open_classpath_files(classpath, &apk_fds)) {
+ return false;
+ }
+
pid_t pid = fork();
if (pid == 0) {
/* child -- drop privileges before continuing */
drop_capabilities(app_shared_gid);
- run_profman_merge(profiles_fd, snapshot_fd);
+ run_profman_merge(profiles_fd, snapshot_fd, &apk_fds);
exit(42); /* only get here on exec failure */
}
@@ -2478,6 +2508,94 @@
return true;
}
+static bool create_boot_image_profile_snapshot(const std::string& package_name,
+ const std::string& profile_name,
+ const std::string& classpath) {
+ // The reference profile directory for the android package might not be prepared. Do it now.
+ const std::string ref_profile_dir =
+ create_primary_reference_profile_package_dir_path(package_name);
+ if (fs_prepare_dir(ref_profile_dir.c_str(), 0770, AID_SYSTEM, AID_SYSTEM) != 0) {
+ PLOG(ERROR) << "Failed to prepare " << ref_profile_dir;
+ return false;
+ }
+
+ // Open and create the snapshot profile.
+ unique_fd snapshot_fd = open_spnashot_profile(AID_SYSTEM, package_name, profile_name);
+
+ // Collect all non empty profiles.
+ // The collection will traverse all applications profiles and find the non empty files.
+ // This has the potential of inspecting a large number of files and directories (depending
+ // on the number of applications and users). So there is a slight increase in the chance
+ // to get get occasionally I/O errors (e.g. for opening the file). When that happens do not
+ // fail the snapshot and aggregate whatever profile we could open.
+ //
+ // The profile snapshot is a best effort based on available data it's ok if some data
+ // from some apps is missing. It will be counter productive for the snapshot to fail
+ // because we could not open or read some of the files.
+ std::vector<std::string> profiles;
+ if (!collect_profiles(&profiles)) {
+ LOG(WARNING) << "There were errors while collecting the profiles for the boot image.";
+ }
+
+ // If we have no profiles return early.
+ if (profiles.empty()) {
+ return true;
+ }
+
+ // Open the classpath elements. These will be used to filter out profile data that does
+ // not belong to the classpath during merge.
+ std::vector<unique_fd> apk_fds;
+ if (!open_classpath_files(classpath, &apk_fds)) {
+ return false;
+ }
+
+ // If we could not open any files from the classpath return an error.
+ if (apk_fds.empty()) {
+ LOG(ERROR) << "Could not open any of the classpath elements.";
+ return false;
+ }
+
+ // Aggregate the profiles in batches of kAggregationBatchSize.
+ // We do this to avoid opening a huge a amount of files.
+ static constexpr size_t kAggregationBatchSize = 10;
+
+ std::vector<unique_fd> profiles_fd;
+ for (size_t i = 0; i < profiles.size(); ) {
+ for (size_t k = 0; k < kAggregationBatchSize && i < profiles.size(); k++, i++) {
+ unique_fd fd = open_profile(AID_SYSTEM, profiles[i], O_RDONLY);
+ if (fd.get() >= 0) {
+ profiles_fd.push_back(std::move(fd));
+ }
+ }
+ pid_t pid = fork();
+ if (pid == 0) {
+ /* child -- drop privileges before continuing */
+ drop_capabilities(AID_SYSTEM);
+
+ run_profman_merge(profiles_fd, snapshot_fd, &apk_fds);
+ exit(42); /* only get here on exec failure */
+ }
+
+ /* parent */
+ int return_code = wait_child(pid);
+ if (!WIFEXITED(return_code)) {
+ PLOG(WARNING) << "profman failed for " << package_name << ":" << profile_name;
+ return false;
+ }
+ return true;
+ }
+ return true;
+}
+
+bool create_profile_snapshot(int32_t app_id, const std::string& package_name,
+ const std::string& profile_name, const std::string& classpath) {
+ if (app_id == -1) {
+ return create_boot_image_profile_snapshot(package_name, profile_name, classpath);
+ } else {
+ return create_app_profile_snapshot(app_id, package_name, profile_name, classpath);
+ }
+}
+
bool prepare_app_profile(const std::string& package_name,
userid_t user_id,
appid_t app_id,
diff --git a/cmds/installd/dexopt.h b/cmds/installd/dexopt.h
index b96351b..93cf545 100644
--- a/cmds/installd/dexopt.h
+++ b/cmds/installd/dexopt.h
@@ -52,6 +52,8 @@
const std::string& profile_name);
// Create a snapshot of the profile information for the given package profile.
+// If appId is -1, the method creates the profile snapshot for the boot image.
+//
// The profile snapshot is the aggregation of all existing profiles (all current user
// profiles & the reference profile) and is meant to capture the all the profile information
// without performing a merge into the reference profile which might impact future dex2oat
@@ -60,8 +62,13 @@
// ownership is assigned to AID_SYSTEM.
// The snapshot location is reference_profile_location.snapshot. If a snapshot is already
// there, it will be truncated and overwritten.
-bool create_profile_snapshot(int32_t app_id, const std::string& package,
- const std::string& profile_name);
+//
+// The classpath acts as filter: only profiling data belonging to elements of the classpath
+// will end up in the snapshot.
+bool create_profile_snapshot(int32_t app_id,
+ const std::string& package,
+ const std::string& profile_name,
+ const std::string& classpath);
bool dump_profiles(int32_t uid,
const std::string& pkgname,
diff --git a/cmds/installd/tests/installd_dexopt_test.cpp b/cmds/installd/tests/installd_dexopt_test.cpp
index 8113542..eac61f4 100644
--- a/cmds/installd/tests/installd_dexopt_test.cpp
+++ b/cmds/installd/tests/installd_dexopt_test.cpp
@@ -14,6 +14,7 @@
* limitations under the License.
*/
+#include <cstdlib>
#include <fcntl.h>
#include <stdlib.h>
#include <string.h>
@@ -153,6 +154,7 @@
InstalldNativeService* service_;
std::unique_ptr<std::string> volume_uuid_;
std::string package_name_;
+ std::string apk_path_;
std::string app_apk_dir_;
std::string app_private_dir_ce_;
std::string app_private_dir_de_;
@@ -202,8 +204,8 @@
service_->createOatDir(app_oat_dir, kRuntimeIsa);
// Copy the primary apk.
- std::string apk_path = app_apk_dir_ + "/base.jar";
- ASSERT_TRUE(WriteBase64ToFile(kDexFile, apk_path, kSystemUid, kSystemGid, 0644));
+ apk_path_ = app_apk_dir_ + "/base.jar";
+ ASSERT_TRUE(WriteBase64ToFile(kDexFile, apk_path_, kSystemUid, kSystemGid, 0644));
// Create the app user data.
ASSERT_TRUE(service_->createAppData(
@@ -470,7 +472,7 @@
bool expected_result) {
bool result;
binder::Status binder_result = service_->createProfileSnapshot(
- appid, package_name, kPrimaryProfile, &result);
+ appid, package_name, kPrimaryProfile, apk_path_, &result);
ASSERT_TRUE(binder_result.isOk());
ASSERT_EQ(expected_result, result);
@@ -561,7 +563,7 @@
ASSERT_EQ(-1, access(code_path_ref_profile.c_str(), R_OK));
}
- private:
+ protected:
void TransitionToSystemServer() {
ASSERT_TRUE(DropCapabilities(kSystemUid, kSystemGid));
int32_t res = selinux_android_setcontext(
@@ -719,5 +721,111 @@
preparePackageProfile(package_name_, "primary.prof", /*expected_result*/ false);
}
+
+class BootProfileTest : public ProfileTest {
+ public:
+ virtual void setup() {
+ ProfileTest::SetUp();
+ intial_android_profiles_dir = android_profiles_dir;
+ }
+
+ virtual void TearDown() {
+ android_profiles_dir = intial_android_profiles_dir;
+ ProfileTest::TearDown();
+ }
+
+ void UpdateAndroidProfilesDir(const std::string& profile_dir) {
+ android_profiles_dir = profile_dir;
+ // We need to create the reference profile directory in the new profile dir.
+ run_cmd("mkdir -p " + profile_dir + "/ref");
+ }
+
+ void createBootImageProfileSnapshot(const std::string& classpath, bool expected_result) {
+ bool result;
+ binder::Status binder_result = service_->createProfileSnapshot(
+ -1, "android", "android.prof", classpath, &result);
+ ASSERT_TRUE(binder_result.isOk());
+ ASSERT_EQ(expected_result, result);
+
+ if (!expected_result) {
+ // Do not check the files if we expect to fail.
+ return;
+ }
+
+ // Check that the snapshot was created with he expected access flags.
+ const std::string boot_profile = create_snapshot_profile_path("android", "android.prof");
+ CheckFileAccess(boot_profile, kSystemUid, kSystemGid, 0600 | S_IFREG);
+
+ pid_t pid = fork();
+ if (pid == 0) {
+ /* child */
+ TransitionToSystemServer();
+
+ // System server should be able to open the snapshot.
+ unique_fd fd(open(boot_profile.c_str(), O_RDONLY));
+ ASSERT_TRUE(fd > -1) << "Failed to open profile as kSystemUid: " << strerror(errno);
+ _exit(0);
+ }
+ /* parent */
+ ASSERT_TRUE(WIFEXITED(wait_child(pid)));
+ }
+ protected:
+ std::string intial_android_profiles_dir;
+};
+
+TEST_F(BootProfileTest, BootProfileSnapshotOk) {
+ LOG(INFO) << "BootProfileSnapshotOk";
+ char* boot_classpath = getenv("BOOTCLASSPATH");
+ ASSERT_TRUE(boot_classpath != nullptr);
+ createBootImageProfileSnapshot(boot_classpath, /*expected_result*/ true);
+}
+
+TEST_F(BootProfileTest, BootProfileSnapshotFailEmptyClasspath) {
+ LOG(INFO) << "BootProfileSnapshotFailEmptyClasspath";
+
+ createBootImageProfileSnapshot(/*boot_classpath*/ "", /*expected_result*/ false);
+}
+
+TEST_F(BootProfileTest, BootProfileSnapshotOkNoProfiles) {
+ LOG(INFO) << "BootProfileSnapshotOkNoProfiles";
+ char* boot_classpath = getenv("BOOTCLASSPATH");
+ ASSERT_TRUE(boot_classpath != nullptr);
+
+ // The app_apk_dir has no profiles. So we shouldn't be able to merge anything.
+ // Still, this is not a failure case.
+ UpdateAndroidProfilesDir(app_apk_dir_);
+ createBootImageProfileSnapshot(boot_classpath, /*expected_result*/ true);
+}
+
+// Verify that profile collection.
+TEST_F(BootProfileTest, CollectProfiles) {
+ LOG(INFO) << "CollectProfiles";
+
+ // Create some profile directories mimicking the real profile structure.
+ run_cmd("mkdir -p " + app_private_dir_de_ + "/profiles/ref");
+ run_cmd("mkdir -p " + app_private_dir_de_ + "/profiles/cur/0/");
+ run_cmd("mkdir -p " + app_private_dir_de_ + "/profiles/cur/1/");
+ // Create an empty profile.
+ run_cmd("touch " + app_private_dir_de_ + "/profiles/cur/1/primary.prof");
+ // Create a random file.
+ run_cmd("touch " + app_private_dir_de_ + "/profiles/cur/0/non.profile.file");
+
+ // Create some non-empty profiles.
+ std::string current_prof = app_private_dir_de_ + "/profiles/cur/0/primary.prof";
+ run_cmd("echo 1 > " + current_prof);
+ std::string ref_prof = app_private_dir_de_ + "/profiles/ref/primary.prof";
+ run_cmd("echo 1 > " + ref_prof);
+
+ UpdateAndroidProfilesDir(app_private_dir_de_ + "/profiles");
+
+ std::vector<std::string> profiles;
+ collect_profiles(&profiles);
+
+ // Only two profiles should be in the output.
+ ASSERT_EQ(2u, profiles.size());
+ ASSERT_TRUE(std::find(profiles.begin(), profiles.end(), current_prof) != profiles.end());
+ ASSERT_TRUE(std::find(profiles.begin(), profiles.end(), ref_prof) != profiles.end());
+}
+
} // namespace installd
} // namespace android
diff --git a/cmds/installd/utils.cpp b/cmds/installd/utils.cpp
index f3d9459..a8c32ed 100644
--- a/cmds/installd/utils.cpp
+++ b/cmds/installd/utils.cpp
@@ -28,6 +28,7 @@
#include <android-base/logging.h>
#include <android-base/strings.h>
#include <android-base/stringprintf.h>
+#include <android-base/unique_fd.h>
#include <cutils/fs.h>
#include <cutils/properties.h>
#include <log/log.h>
@@ -41,7 +42,9 @@
#define DEBUG_XATTRS 0
+using android::base::EndsWith;
using android::base::StringPrintf;
+using android::base::unique_fd;
namespace android {
namespace installd {
@@ -985,5 +988,75 @@
return 0;
}
+// Collect all non empty profiles from the given directory and puts then into profile_paths.
+// The profiles are identified based on PROFILE_EXT extension.
+// If a subdirectory or profile file cannot be opened the method logs a warning and moves on.
+// It returns true if there were no errors at all, and false otherwise.
+static bool collect_profiles(DIR* d,
+ const std::string& current_path,
+ std::vector<std::string>* profiles_paths) {
+ int32_t dir_fd = dirfd(d);
+ if (dir_fd < 0) {
+ return false;
+ }
+
+ bool result = true;
+ struct dirent* dir_entry;
+ while ((dir_entry = readdir(d))) {
+ std::string name = dir_entry->d_name;
+ std::string local_path = current_path + "/" + name;
+
+ if (dir_entry->d_type == DT_REG) {
+ // Check if this is a non empty profile file.
+ if (EndsWith(name, PROFILE_EXT)) {
+ struct stat st;
+ if (stat(local_path.c_str(), &st) != 0) {
+ PLOG(WARNING) << "Cannot stat local path " << local_path;
+ result = false;
+ continue;
+ } else if (st.st_size > 0) {
+ profiles_paths->push_back(local_path);
+ }
+ }
+ } else if (dir_entry->d_type == DT_DIR) {
+ // always skip "." and ".."
+ if (name == "." || name == "..") {
+ continue;
+ }
+
+ unique_fd subdir_fd(openat(dir_fd, name.c_str(),
+ O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC));
+ if (subdir_fd < 0) {
+ PLOG(WARNING) << "Could not open dir path " << local_path;
+ result = false;
+ continue;
+ }
+
+ DIR* subdir = fdopendir(subdir_fd);
+ if (subdir == NULL) {
+ PLOG(WARNING) << "Could not open dir path " << local_path;
+ result = false;
+ continue;
+ }
+ bool new_result = collect_profiles(subdir, local_path, profiles_paths);
+ result = result && new_result;
+ if (closedir(subdir) != 0) {
+ PLOG(WARNING) << "Could not close dir path " << local_path;
+ }
+ }
+ }
+
+ return result;
+}
+
+bool collect_profiles(std::vector<std::string>* profiles_paths) {
+ DIR* d = opendir(android_profiles_dir.c_str());
+ if (d == NULL) {
+ return false;
+ } else {
+ return collect_profiles(d, android_profiles_dir, profiles_paths);
+ }
+}
+
} // namespace installd
} // namespace android
diff --git a/cmds/installd/utils.h b/cmds/installd/utils.h
index b18e7dd..b74073c 100644
--- a/cmds/installd/utils.h
+++ b/cmds/installd/utils.h
@@ -136,6 +136,12 @@
int prepare_app_cache_dir(const std::string& parent, const char* name, mode_t target_mode,
uid_t uid, gid_t gid);
+// Collect all non empty profiles from the global profile directory and
+// put then into profile_paths. The profiles are identified based on PROFILE_EXT extension.
+// If a subdirectory or profile file cannot be opened the method logs a warning and moves on.
+// It returns true if there were no errors at all, and false otherwise.
+bool collect_profiles(std::vector<std::string>* profiles_paths);
+
} // namespace installd
} // namespace android